HackTheBox - Jail

IppSec · Intermediate ·🔐 Cybersecurity ·8y ago
00:52 - Recon - NMAP 04:05 - Recon - Getting Linux Distro 04:35 - Recon - GoBuster 05:40 - Analyzing Jail.c source 09:45 - Begin Binary Exploitation 15:10 - Verify Buffer Overflow 17:35 - Create Exploit Skeleton 20:50 - Finding EIP Overwrite 23:02 - Adding Reverse TCP Shellcode 30:15 - Switching to "Socket Re-Use" Shellcode 32:20 - Shell Returned 34:00 - NFSv3 Privesc Begin 40:15 - Begin incorrectly playing with SetUID 43:10 - SELinux Escape 45:25 - Using SELinux Escape to copy SSH Key 48:55 - Logging in as Frank 50:00 - Privesc to adm (sudo rvim) 51:44 - Begin of finding a way to root 55:58 - Begin cracking rar file 57:18 - Using Hashcat to generate custom wordlist 60:40 - Cracking with JohnTheRipper 62:30 - RsaCtfTool to exploit weak SSH Pub Key 63:36 - Login as root with SSH Private Key 64:11 - EXTRA CONTENT: Alternative Privesc to ADM (NFS) 65:21 - Creating a directory to give other users NFS Write access 67:30 - Correct way to do SetUID Program 71:04 - Using SetUID Programs to write to disk
Watch on YouTube ↗ (saves to browser)
Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from IppSec · IppSec · 21 of 60

← Previous Next →
1 HHC2016 - Analytics
HHC2016 - Analytics
IppSec
 2 HackTheBox - October
HackTheBox - October
IppSec
 3 HackTheBox - Arctic
HackTheBox - Arctic
IppSec
 4 HackTheBox - Brainfuck
HackTheBox - Brainfuck
IppSec
 5 HackTheBox - Bank
HackTheBox - Bank
IppSec
 6 HackTheBox - Joker
HackTheBox - Joker
IppSec
 7 HackTheBox - Lazy
HackTheBox - Lazy
IppSec
 8 Camp CTF 2015 - Bitterman
Camp CTF 2015 - Bitterman
IppSec
 9 HackTheBox - Devel
HackTheBox - Devel
IppSec
 10 Reversing Malicious Office Document (Macro) Emotet(?)
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
 11 HackTheBox - Granny and Grandpa
HackTheBox - Granny and Grandpa
IppSec
 12 HackTheBox - Pivoting Update: Granny and Grandpa
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
 13 HackTheBox - Optimum
HackTheBox - Optimum
IppSec
 14 HackTheBox - Charon
HackTheBox - Charon
IppSec
 15 HackTheBox - Sneaky
HackTheBox - Sneaky
IppSec
 16 HackTheBox - Holiday
HackTheBox - Holiday
IppSec
 17 HackTheBox - Europa
HackTheBox - Europa
IppSec
 18 Introduction to tmux
Introduction to tmux
IppSec
 19 HackTheBox - Blocky
HackTheBox - Blocky
IppSec
 20 HackTheBox - Nineveh
HackTheBox - Nineveh
IppSec
 ▶ HackTheBox - Jail
HackTheBox - Jail
IppSec
 22 HackTheBox - Blue
HackTheBox - Blue
IppSec
 23 HackTheBox - Calamity
HackTheBox - Calamity
IppSec
 24 HackTheBox - Shrek
HackTheBox - Shrek
IppSec
 25 HackTheBox - Mirai
HackTheBox - Mirai
IppSec
 26 HackTheBox - Shocker
HackTheBox - Shocker
IppSec
 27 HackTheBox - Mantis
HackTheBox - Mantis
IppSec
 28 HackTheBox - Node
HackTheBox - Node
IppSec
 29 HackTheBox - Kotarak
HackTheBox - Kotarak
IppSec
 30 HackTheBox - Enterprise
HackTheBox - Enterprise
IppSec
 31 HackTheBox - Sense
HackTheBox - Sense
IppSec
 32 HackTheBox - Minion
HackTheBox - Minion
IppSec
 33 VulnHub - Sokar
VulnHub - Sokar
IppSec
 34 VulnHub - Pinkys Palace v2
VulnHub - Pinkys Palace v2
IppSec
 35 HackTheBox - Inception
HackTheBox - Inception
IppSec
 36 Vulnhub - Trollcave 1.2
Vulnhub - Trollcave 1.2
IppSec
 37 HackTheBox - Ariekei
HackTheBox - Ariekei
IppSec
 38 HackTheBox - Flux Capacitor
HackTheBox - Flux Capacitor
IppSec
 39 HackTheBox - Jeeves
HackTheBox - Jeeves
IppSec
 40 HackTheBox - Tally
HackTheBox - Tally
IppSec
 41 HackTheBox - CrimeStoppers
HackTheBox - CrimeStoppers
IppSec
 42 HackTheBox - Fulcrum
HackTheBox - Fulcrum
IppSec
 43 HackTheBox - Chatterbox
HackTheBox - Chatterbox
IppSec
 44 HackTheBox - Falafel
HackTheBox - Falafel
IppSec
 45 How To Create Empire Modules
How To Create Empire Modules
IppSec
 46 HackTheBox - Nightmare
HackTheBox - Nightmare
IppSec
 47 HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
IppSec
 48 HackTheBox - Bart
HackTheBox - Bart
IppSec
 49 HackTheBox - Aragog
HackTheBox - Aragog
IppSec
 50 HackTheBox - Valentine
HackTheBox - Valentine
IppSec
 51 HackTheBox - Silo
HackTheBox - Silo
IppSec
 52 HackTheBox - Rabbit
HackTheBox - Rabbit
IppSec
 53 HackTheBox - Celestial
HackTheBox - Celestial
IppSec
 54 HackTheBox - Stratosphere
HackTheBox - Stratosphere
IppSec
 55 HackTheBox - Poison
HackTheBox - Poison
IppSec
 56 HackTheBox - Canape
HackTheBox - Canape
IppSec
 57 HackTheBox - Olympus
HackTheBox - Olympus
IppSec
 58 HackTheBox - Sunday
HackTheBox - Sunday
IppSec
 59 HackTheBox - Fighter
HackTheBox - Fighter
IppSec
 60 HackTheBox - Bounty
HackTheBox - Bounty
IppSec

Related AI Lessons

⚡
Stop Storing JWTs in localStorage: A Security Guide for Web Developers
Learn why storing JWTs in localStorage is insecure and how to secure your web application's authentication, which is crucial for protecting user data
Dev.to · Damilola Owolabi
 ⚡
Inside Consumer DVRs — Hardware, Firmware & Network Security Evaluation
Learn about the hardware, firmware, and network security of consumer DVRs through a reverse engineering analysis of the Hikvision DS-7204HUHI-K
Medium · Cybersecurity
 ⚡
Cómo construimos un SOC con honeypot e IA local
Learn how to build a Security Operations Center (SOC) using honeypot and local AI to detect and prevent cyber threats
Dev.to · Yoandy Ramirez Delgado
 ⚡
Credentials in web applications: how to store them properly
Learn how to store credentials properly in web applications to prevent breaches
Dev.to · Ian Johnson

Chapters (27)

0:52 Recon - NMAP
4:05 Recon - Getting Linux Distro
4:35 Recon - GoBuster
5:40 Analyzing Jail.c source
9:45 Begin Binary Exploitation
15:10 Verify Buffer Overflow
17:35 Create Exploit Skeleton
20:50 Finding EIP Overwrite
23:02 Adding Reverse TCP Shellcode
30:15 Switching to "Socket Re-Use" Shellcode
32:20 Shell Returned
34:00 NFSv3 Privesc Begin
40:15 Begin incorrectly playing with SetUID
43:10 SELinux Escape
45:25 Using SELinux Escape to copy SSH Key
48:55 Logging in as Frank
50:00 Privesc to adm (sudo rvim)
51:44 Begin of finding a way to root
55:58 Begin cracking rar file
57:18 Using Hashcat to generate custom wordlist
1:00:40 Cracking with JohnTheRipper
1:02:30 RsaCtfTool to exploit weak SSH Pub Key
1:03:36 Login as root with SSH Private Key
1:04:11 EXTRA CONTENT: Alternative Privesc to ADM (NFS)
1:05:21 Creating a directory to give other users NFS Write access
1:07:30 Correct way to do SetUID Program
1:11:04 Using SetUID Programs to write to disk
Up next
A single PR just hijacked the NPM registry...
Fireship
Watch →